Chapter 24: Extended access control lists
This introduction contrasts extended ACLs with standard ACLs and explains the ACL behavior they share.
After this chapter you will be able to
- Extended ACL filtering precision. Explain why extended ACLs provide more precise traffic control than standard ACLs.
- Shared ACL processing rules. Describe the processing and application rules that extended ACLs share with standard ACLs.
- Extended ACL matching criteria. Describe the packet information an extended ACL can use to filter traffic: payload protocol, source or destination IP address, and source or destination TCP/UDP port.
- Three-parameter packet matching. Explain that an extended ACL entry matches a packet only when its protocol, source IP address, and destination IP address all match the values specified in that entry.
- TEST1 traffic filtering. Trace which traffic the example ACL TEST1 permits and denies, taking account of the earlier exception for PC1 and the interface direction where TEST1 is applied.
- Extended ACL placement rationale. Justify placing an extended ACL close to the traffic source, and contrast that guidance with the placement of a standard ACL.
- Port comparison operators. Explain how eq, gt, lt, neq, and range determine which TCP or UDP port numbers an ACE matches, including whether the stated endpoints are included.
- Complete ACE matching. Explain how an ACE can specify a source port, a destination port, or both, and how a packet is judged against the parameters that are specified.
- Bidirectional ICMP-only access. Explain why the restriction between Server LAN A and Server LAN B uses two inbound ACLs, and how those ACLs leave traffic to other destinations permitted.
- Engineering HTTP restriction. Describe where the engineering HTTP restriction is applied and which port an ACL must match to filter a client's HTTP request to a server.
- Accounting TFTP restriction. Describe the two-ACE ACL used to deny accounting hosts' TFTP traffic while allowing their other traffic, including where it is applied.
- ACE order and later edits. Explain that a router processes an ACL’s ACEs in the order they are configured, so an ACL may later need an ACE deleted or a new ACE inserted between existing ones.
- Individual ACE deletion. Explain why negating an ACE command from global configuration mode can delete an entire numbered ACL, and describe how to delete only the ACE from named ACL configuration mode.
- Resequencing ACL entries. Explain when to use `ip access-list resequence` and how its arguments create space between existing ACEs for new entries.
What it builds on
- ACL types (chapter 23) · Introduces ACL types, including standard ACLs.
- How ACLs work (chapter 23) · Explains the ACL fundamentals that also apply to extended ACLs.
- Numbered ACLs (chapter 23) · Introduces numbered ACL configuration.
- Named ACLs (chapter 23) · Introduces named ACL configuration.
- Matching and acting on packets (chapter 23) · ACL entries match packets and act on matching traffic.
- Configuring standard ACLs (chapter 23) · The source-address matching options introduced with standard ACLs.
- Applying ACLs (chapter 23) · An ACL is applied to traffic in a specified interface direction.
- Port numbers (chapter 22) · The meaning of port numbers.
Section by section
Introduction
This introduction contrasts extended ACLs with standard ACLs and explains the ACL behavior they share.
- Extended ACL filtering precision: Explain why extended ACLs provide more precise traffic control than standard ACLs.
Why it matters: This distinction explains when the added precision of an extended ACL is useful. - Shared ACL processing rules: Describe the processing and application rules that extended ACLs share with standard ACLs.
Why it matters: More precise matching does not change the basic rules that determine whether an ACL affects traffic.
Key terms: standard ACLs, extended ACLs, source IP address, access control entries (ACEs), implicit deny, inbound, outbound
24.1 Configuring extended ACLs
This section identifies what extended ACLs can match and how their configuration relates to standard ACLs.
- Extended ACL matching criteria: Describe the packet information an extended ACL can use to filter traffic: payload protocol, source or destination IP address, and source or destination TCP/UDP port.
Why it matters: These matching choices explain what extended ACLs can filter. - Extended ACL configuration approach: Explain how extended ACL configuration resembles standard ACL configuration and why it requires additional keywords and arguments.
Why it matters: The familiar configuration approach carries over, while the extra matching choices change what commands must specify.
Key terms: extended ACLs, protocol, source, destination, TCP/UDP ports, numbered ACLs, named ACL config mode, global config mode, access-list, ip access-list
24.1.1 Matching protocol, source, and destination
This section explains how extended ACL entries match protocol, source, and destination, then uses an example ACL to show their effect and why extended ACLs are placed near the source.
- Three-parameter packet matching: Explain that an extended ACL entry matches a packet only when its protocol, source IP address, and destination IP address all match the values specified in that entry.
Why it matters: This is the basic rule for deciding whether an extended ACL entry applies to a packet. - Protocol and address options: Describe how protocol keywords and source or destination address forms specify the packets an extended ACL entry matches, including how to specify any IPv4 protocol, any address, or one host.
Why it matters: These options let you read which traffic an entry targets without treating ip or any as a narrower match than they are. - TEST1 traffic filtering: Trace which traffic the example ACL TEST1 permits and denies, taking account of the earlier exception for PC1 and the interface direction where TEST1 is applied.
Why it matters: The example shows why both entry order and where the ACL is applied matter when describing its effect. - Extended ACL placement rationale: Justify placing an extended ACL close to the traffic source, and contrast that guidance with the placement of a standard ACL.
Why it matters: Placement determines whether unwanted traffic is stopped early while legitimate traffic remains unaffected.
Key terms: ACE, protocol, source, destination, ip, any, host, wildcard mask, TEST1, outbound
24.1.2 Matching TCP/UDP port numbers
This subsection explains how extended ACL entries use TCP or UDP port conditions to match traffic more precisely.
- Port comparison operators: Explain how eq, gt, lt, neq, and range determine which TCP or UDP port numbers an ACE matches, including whether the stated endpoints are included.
Why it matters: The operator determines exactly which port values a permit or deny entry covers. - Complete ACE matching: Explain how an ACE can specify a source port, a destination port, or both, and how a packet is judged against the parameters that are specified.
Why it matters: This rule lets you work out whether a packet matches a port-specific ACE without treating an omitted port as a denial. - Port keyword equivalents: Describe how some well-known port numbers can be written as keywords in an ACE and how those keywords can appear in show-command output.
Why it matters: Recognizing keyword equivalents helps you read ACEs and show-command output that use names instead of numbers.
Key terms: eq, gt, lt, neq, range, operator, ACE, source port, destination port, match
24.2 Example security requirements
The section works through extended ACLs that meet three security requirements while permitting traffic outside each restriction.
- Bidirectional ICMP-only access: Explain why the restriction between Server LAN A and Server LAN B uses two inbound ACLs, and how those ACLs leave traffic to other destinations permitted.
Why it matters: The rule must cover both directions without blocking unrelated traffic. - Engineering HTTP restriction: Describe where the engineering HTTP restriction is applied and which port an ACL must match to filter a client's HTTP request to a server.
Why it matters: Matching the wrong port would not express the intended client-to-server HTTP restriction. - Accounting TFTP restriction: Describe the two-ACE ACL used to deny accounting hosts' TFTP traffic while allowing their other traffic, including where it is applied.
Why it matters: The permit ACE keeps a targeted TFTP restriction from blocking unrelated traffic.
Key terms: ICMP, inbound, permit ip any any ACE, HTTP, TCP, destination port, port 80, TFTP, ACE, numbered ACL
24.3 Editing ACLs
Explains why ACE order matters and why an ACL may need editing after it is configured.
- ACE order and later edits: Explain that a router processes an ACL’s ACEs in the order they are configured, so an ACL may later need an ACE deleted or a new ACE inserted between existing ones.
Why it matters: ACE order affects how the router evaluates packets, so changing an ACL may require changing its entries.
Key terms: ACL, ACE, standard ACLs, extended ACLs
24.3.1 Deleting ACEs
This subsection explains how to delete an individual ACE without deleting its ACL and how to insert a replacement ACE at a chosen sequence number.
- Individual ACE deletion: Explain why negating an ACE command from global configuration mode can delete an entire numbered ACL, and describe how to delete only the ACE from named ACL configuration mode.
Why it matters: Using the right configuration mode prevents you from accidentally deleting an entire ACL. - ACE insertion by sequence: Describe how to insert a new ACE between existing entries in named ACL configuration mode.
Why it matters: Sequence numbers let you place a replacement ACE where it belongs in the ACL.
Key terms: ACE, numbered ACL, named ACL config mode, sequence number, no
24.3.2 Resequencing ACEs
This section explains how to renumber ACL entries when their sequence numbers leave no room to insert a new entry.
- Resequencing ACL entries: Explain when to use `ip access-list resequence` and how its arguments create space between existing ACEs for new entries.
Why it matters: Resequencing lets you insert an ACE where it belongs without being blocked by adjacent sequence numbers.
Key terms: ACE, sequence number, ip access-list resequence, starting-seq-num, increment
24.4 Summary
Concepts explained in this chapter
- access control entryAn access control entry is an ordered rule in an access control list that specifies packet-matching conditions and an action such as permitting or denying traffic.
- extended access control listAn extended access control list is an access control list that filters packets using multiple packet attributes, including Layer 4 protocols, source and destination IP addresses, and source and destination ports.
- extended named aclAn extended named ACL is an extended access control list identified by a name.
- extended numbered aclAn extended numbered ACL is an extended access control list identified by a number from the extended ACL ranges.
- acl port operatorAn ACL port operator is a Cisco IOS access-control-list argument that specifies a relational test or interval for matching transport-layer port numbers.
- named acl config modeNamed ACL config mode is a Cisco IOS configuration mode in which individual access control entries are added or edited for an access control list.
- ip keywordThe ip keyword in a Cisco IOS extended ACL matches all IPv4 packets regardless of their encapsulated protocol.
- access control listA standard access control list is an IPv4 access control list that filters traffic primarily by source IP address.
- port numberA port number is a transport-layer identifier ranging from 0 to 65535 that directs network data to a particular application process on a host.
- Trivial File Transfer ProtocolTrivial File Transfer Protocol is a simple file-transfer protocol that provides its own acknowledgment-based reliability while using UDP.
- acl sequence numberAn ACL sequence number is an ordering value assigned to an access control entry within an access control list.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.